Patchwork [1/1] netfilter: nf_ct_helper: don't discard helper if it is actually the same

login
register
mail settings
Submitter Florian Westphal
Date Feb. 12, 2013, 3:59 p.m.
Message ID <1360684793-32109-1-git-send-email-fw@strlen.de>
Download mbox | patch
Permalink /patch/219872/
State Accepted
Headers show

Comments

Florian Westphal - Feb. 12, 2013, 3:59 p.m.
commit 32f5376003920a8bc1bd97c6cddcf42df0b6a833
(netfilter: nf_ct_helper: disable automatic helper re-assignment of different type)
breaks transparent proxy scenarios.

For example, initial helper lookup might yield "ftp" (dport 21),
while re-lookup after REDIRECT yields "ftp-2121".

This causes the autoassign code to toss the ftp helper, even
though these are just different instances of the same.

Change the test to check for the helper function address instead
of the helper address, as suggested by Pablo.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 net/netfilter/nf_conntrack_helper.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
Pablo Neira - Feb. 12, 2013, 10:36 p.m.
On Tue, Feb 12, 2013 at 04:59:53PM +0100, Florian Westphal wrote:
> commit 32f5376003920a8bc1bd97c6cddcf42df0b6a833
> (netfilter: nf_ct_helper: disable automatic helper re-assignment of different type)
> breaks transparent proxy scenarios.
> 
> For example, initial helper lookup might yield "ftp" (dport 21),
> while re-lookup after REDIRECT yields "ftp-2121".
> 
> This causes the autoassign code to toss the ftp helper, even
> though these are just different instances of the same.
> 
> Change the test to check for the helper function address instead
> of the helper address, as suggested by Pablo.

Also applied this one, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 884f2b3..6357441 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -236,7 +236,8 @@  int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
 		/* We only allow helper re-assignment of the same sort since
 		 * we cannot reallocate the helper extension area.
 		 */
-		if (help->helper != helper) {
+		struct nf_conntrack_helper *tmp = rcu_dereference(help->helper);
+		if (tmp && tmp->help != helper->help) {
 			RCU_INIT_POINTER(help->helper, NULL);
 			goto out;
 		}